EUVD-2026-81874

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend Runtime PM must be enabled before creating the PHY, since phycreate only enables runtime PM on the PHY device if it is already enabled on this parent...

CVE-2026-90249

This Linux kernel vulnerability affects the gp2ap002 IIO light/proximity sensor driver. The root cause is that the IIO core does not filter duplicate writes to the event enable attribute, causing write_event_config() to be invoked twice. Enabling an event twice leaks a runtime PM reference, preve...

EUVD-2026-81842

In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes The IIO core does not filter duplicate writes to the event enable attribute, so writing the same value twice invokes writeeventconfig twice. Enabling twice...

CVE-2026-90249 iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes

In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes The IIO core does not filter duplicate writes to the event enable attribute, so writing the same value twice invokes writeeventconfig twice. Enabling twice...

CVE-2026-90249 iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes

In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes The IIO core does not filter duplicate writes to the event enable attribute, so writing the same value twice invokes writeeventconfig twice. Enabling twice...

CVE-2026-90212

CVE-2026-90212 affects the Linux kernel on arm64 systems that enable software PAN (CONFIG_ARM64_SW_TTBR0_PAN=y) and use EFI runtime services. The fpsimd context management code called from __efi_fpsimd_begin() can voluntarily preempt, causing the code to return to the EFI runtime service call wit...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the ByteArrayProtoReader32 fast path in wire-runtime/src/commonMain/kotlin/com/squareup/wire/ByteArrayProtoReader32.kt. An attacker can crash protobuf decoding by supplying a length-delimited field wit...

com.squareup.misk:misk (0.11.0), com.squareup.misk:misk-aws (0.11.0) +34 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (3.1.0)

com.squareup.wire:wire-runtime MAVEN version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.misk:misk 0.11.0 - com.squareup.misk:misk-aws 0.11.0 -...

com.squareup.wire:wire-compiler (3.3.0), com.squareup.wire:wire-gradle-plugin (3.3.0) +8 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (3.3.0)

com.squareup.wire:wire-runtime MAVEN version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 3.3.0 - com.squareup.wire:wire-gradle-plugin 3.3.0 -...

app.cash.backfila:client (0.1.3-20210127.1838-76ab4fc), app.cash.backfila:client-misk (0.1.3-20210127.1838-76ab4fc) +16 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (3.5.0)

com.squareup.wire:wire-runtime MAVEN version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - app.cash.backfila:client 0.1.3-20210127.1838-76ab4fc - app.cash.backfila:client-misk...

com.agorapulse:micronaut-amazon-awssdk-kinesis-worker (>=1.7.2-micronaut-1.0, <=2.2.2-micronaut-3.0), com.amazonaws:amazon-kinesis-producer (>=0.14.12, <=0.15.7) +113 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (3.7.1)

com.squareup.wire:wire-runtime MAVEN version 3.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.agorapulse:micronaut-amazon-awssdk-kinesis-worker =1.7.2-micronaut-1.0, =0.14.12, =1.0.191,...

com.squareup.wire:wire-compiler (4.0.0-alpha.1), com.squareup.wire:wire-gradle-plugin (4.0.0-alpha.1) +13 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.0.0-alpha.1)

com.squareup.wire:wire-runtime MAVEN version 4.0.0-alpha.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 4.0.0-alpha.1 - com.squareup.wire:wire-gradle-plugin...

com.squareup.wire:wire-compiler (4.0.0-alpha.3), com.squareup.wire:wire-gradle-plugin (4.0.0-alpha.3) +13 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.0.0-alpha.3)

com.squareup.wire:wire-runtime MAVEN version 4.0.0-alpha.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 4.0.0-alpha.3 - com.squareup.wire:wire-gradle-plugin...

com.squareup.misk:misk (0.18.0), com.squareup.misk:misk-aws (0.18.0) +42 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.0.0-alpha.4)

com.squareup.wire:wire-runtime MAVEN version 4.0.0-alpha.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.misk:misk 0.18.0 - com.squareup.misk:misk-aws 0.18.0 -...

com.squareup.wire:wire-compiler (4.0.0-alpha.6), com.squareup.wire:wire-gradle-plugin (4.0.0-alpha.6) +13 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.0.0-alpha.6)

com.squareup.wire:wire-runtime MAVEN version 4.0.0-alpha.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 4.0.0-alpha.6 - com.squareup.wire:wire-gradle-plugin...

com.squareup.wire:wire-grpc-client (4.0.0-alpha.16), com.squareup.wire:wire-schema (4.0.0-alpha.16) potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.0.0-alpha.16)

com.squareup.wire:wire-runtime MAVEN version 4.0.0-alpha.16 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.0.0-alpha.16 - com.squareup.wire:wire-schema...

com.squareup.wire:wire-grpc-client (4.1.1), com.squareup.wire:wire-schema (4.1.1) potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.1.1)

com.squareup.wire:wire-runtime MAVEN version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.1.1 - com.squareup.wire:wire-schema 4.1.1 Source cves:...

androidx.benchmark:benchmark-common (>=1.2.0-alpha14, <=1.2.0-alpha15), androidx.benchmark:benchmark-junit4 (>=1.2.0-alpha14, <=1.2.0-alpha15) +5 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.5.1)

com.squareup.wire:wire-runtime MAVEN version 4.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - androidx.benchmark:benchmark-common =1.2.0-alpha14, =1.2.0-alpha14, =1.2.0-alpha14, =1.2.0-alpha14,...

com.squareup.wire:wire-grpc-client (4.5.3), com.squareup.wire:wire-schema (4.5.3) potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.5.3)

com.squareup.wire:wire-runtime MAVEN version 4.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.5.3 - com.squareup.wire:wire-schema 4.5.3 Source cves:...

com.squareup.wire:wire-grpc-client (4.9.0), com.squareup.wire:wire-schema (4.9.0) +1 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.9.0)

com.squareup.wire:wire-runtime MAVEN version 4.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.0 - com.squareup.wire:wire-schema 4.9.0 -...